¡¾Îó²îͨ¸æ¡¿Apache mod_http2Ä£¿éË«ÖØÊÍ·ÅÎó²î(CVE-2026-23918)

Ðû²¼Ê±¼ä 2026-05-08

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Apache mod_http2Ä£¿éË«ÖØÊÍ·ÅÎó²î

CVE   ID

CVE-2026-23918

Îó²îÀàÐÍ

ÄÚ´æÆÆËð

·¢Ã÷ʱ¼ä

2026-5-8

Îó²îÆÀ·Ö

8.8

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

²»ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


Apache HTTP Server£¨Apache httpd£©ÊÇApache Software FoundationÐû²¼µÄ¿ªÔ´Web·þÎñÆ÷Èí¼þ£¬ÆÕ±éÓ¦ÓÃÓÚ»¥ÁªÍøÍøÕ¾¡¢ÆóÒµÃÅ»§¡¢API·þÎñ¼°ÔÆ»ù´¡ÉèÊ©³¡¾°¡£ÆäÖ§³ÖHTTP/1.1¡¢HTTP/2¡¢TLS¡¢·´Ïò´úÀí¼°Ä£¿é»¯À©Õ¹µÈ¹¦Ð§£¬¾ßÓи߼æÈÝÐÔ¡¢¸ßÎȹÌÐÔ¼°¸»ºñÉú̬£¬ÊÇÈ«ÇòʹÓÃ×îÆÕ±éµÄWeb·þÎñÆ÷Ö®Ò»¡£


2026Äê5ÔÂ8ÈÕ£¬×ðÁú¿­¹ÙÍøÈë¿ÚÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄ£¨VSRC£©¼à²âµ½Apache mod_http2Ä£¿éË«ÖØÊÍ·ÅÎó²î¡£¸ÃÎó²îÓÉÓÚ·þÎñÆ÷ÔÚ´¦Öóͷ£HTTP/2ÅþÁ¬ÔçÆÚÖØÖã¨early reset£©ÇëÇóʱ£¬¶ÔÄÚ´æ×ÊÔ´ÊÍ·ÅÂß¼­±£´æÈ±ÏÝ£¬µ¼ÖÂͳһÄڴ湤¾ß±»Öظ´ÊÍ·Å£¬½ø¶ø¿ÉÄÜÒý·¢ÄÚ´æÆÆËð¡£¹¥»÷Õß¿Éͨ¹ý½á¹¹¶ñÒâHTTP/2ÇëÇó´¥·¢Òì³£ÄÚ´æ²Ù×÷£¬Ôì³É·þÎñÍ߽⣬²¢ÔÚÌØ¶¨Ìõ¼þϽøÒ»²½ÊµÏÖÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©¡£¸ÃÎó²î¿ÉÄܵ¼ÖÂWeb·þÎñ²»¿ÉÓᢷþÎñÆ÷ȨÏÞʧÏݼ°ÓªÒµÊý¾Ýй¶£¬½ø¶øÓ°ÏìÓªÒµÒ»Á¬ÐÔ¡£


¶þ¡¢Ó°Ïì¹æÄ£


Apache HTTP Server = 2.4.66


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´²¹¶¡£¬ÒÔÐÞ¸´¸ÃÎó²î¡£
Apache HTTP Server >= 2.4.67


ÏÂÔØÁ´½Ó£ºhttps://httpd.apache.org/download.cgi/


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


? °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
? ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
? Ê¹ÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
? ÔöǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://httpd.apache.org/security/vulnerabilities_24.html/
https://www.openwall.com/lists/oss-security/2026/05/04/19/
https://nvd.nist.gov/vuln/detail/CVE-2026-23918